pghs975uc
/
infer_clone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '4677584018'
${ noResults }
infer_clone/sledge/semantics/llair_propScript.sml

594 lines
18 KiB
Raw Normal View History Unescape

[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
(*
* Copyright (c) Facebook, Inc. and its affiliates.
*
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*)
(* Properties of the llair model *)
open HolKernel boolLib bossLib Parse;
[sledge sem] Add top-level llair semantics Summary: Give the llair semantics observable side effects (writes to global variables) and a semantic function mirroring the LLVM semantics. Start sketching out the LLVM/llair translation equivalence proof in a top-down way from the obvious statement of equality of the semantics. Reviewed By: jberdine Differential Revision: D17399654 fbshipit-source-id: 2170678a8
5 years ago
open arithmeticTheory integerTheory integer_wordTheory wordsTheory listTheory;
[sledge sem] Sketch out translation correctness Summary: This is work in progress; many of the cheats aren't true. In particular, the definition of stuck/complete/partial traces in LLVM and llair don't quite match up and need some modification. Also, the state relation isn't strong enough; it will need to include information about registers used in the expressions of the LLVM register to llair expression mapping. But the overall shape of the proof is ok and so it can be used to poke at various local aspects of the translation, such as individual instructions. Reviewed By: jberdine Differential Revision: D17631604 fbshipit-source-id: 743b5d64d
5 years ago
open pred_setTheory finite_mapTheory;
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
open settingsTheory miscTheory llairTheory;
new_theory "llair_prop";
numLib.prefer_num ();
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
Theorem signed2unsigned_fits:
0 < n ∧ ifits i n ⇒ ifits (&signed2unsigned i n) (n + 1)
Proof
rw [signed2unsigned_def, ifits_def]
>- (
`?j. i = -&j` by intLib.COOPER_TAC >>
rw [] >> fs [] >>
rfs [EXP_SUB] >>
`j ≤ 2 ** n` by intLib.COOPER_TAC >>
rw [INT_SUB, GSYM int_sub])
>- (
`?j. i = &j` by intLib.COOPER_TAC >>
rw [] >> fs [] >>
rw [INT_SUB, GSYM int_sub] >>
rfs [EXP_SUB] >>
intLib.COOPER_TAC)
QED
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
Theorem i2n_n2i:
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
∀n size. 0 < size ⇒ (nfits n size ⇔ (i2n (n2i n size) = n))
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
Proof
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
rw [nfits_def, n2i_def, i2n_def, signed2unsigned_def] >> rw []
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
>- intLib.COOPER_TAC
>- (
`2 ** size ≤ n` by intLib.COOPER_TAC >> simp [INT_SUB] >>
Cases_on `n = 0` >> fs [] >>
`n - 2 ** size < n` suffices_by intLib.COOPER_TAC >>
irule SUB_LESS >> simp [])
>- (
`2 ** (size - 1) < 2 ** size` suffices_by intLib.COOPER_TAC >>
fs [])
QED
Theorem n2i_i2n:
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
∀i size. 0 < size ⇒ (ifits i size ⇔ (n2i (i2n (IntV i size)) size) = IntV i size)
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
Proof
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
rw [ifits_def, n2i_def, i2n_def, signed2unsigned_def] >> rw [] >> fs []
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
>- (
eq_tac >> rw []
>- (
simp [intLib.COOPER_PROVE ``∀(x:int) y z. x - y = z ⇔ x = y + z``] >>
`2 ** (size - 1) < 2 ** size` suffices_by intLib.COOPER_TAC >>
fs [INT_OF_NUM])
>- (
fs [intLib.COOPER_PROVE ``∀(x:int) y z. x - y = z ⇔ x = y + z``] >>
fs [INT_OF_NUM] >>
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
`∃j. i = -j` by intLib.COOPER_TAC >> rw [] >> fs [] >>
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
qpat_x_assum `_ ≤ Num _` mp_tac >>
fs [GSYM INT_OF_NUM] >>
ASM_REWRITE_TAC [GSYM INT_LE] >> rw [] >>
`2 ** size = 2 * 2 ** (size - 1)` by rw [GSYM EXP, ADD1] >> fs [] >>
intLib.COOPER_TAC)
>- intLib.COOPER_TAC)
>- (
eq_tac >> rw []
>- intLib.COOPER_TAC
>- intLib.COOPER_TAC >>
`0 ≤ i` by intLib.COOPER_TAC >>
fs [GSYM INT_OF_NUM] >>
`&(2 ** size) = 0` by intLib.COOPER_TAC >>
fs [])
>- (
eq_tac >> rw []
>- (
`2 ** size = 2 * 2 ** (size - 1)` by rw [GSYM EXP, ADD1] >> fs [] >>
intLib.COOPER_TAC)
>- intLib.COOPER_TAC
>- intLib.COOPER_TAC)
>- intLib.COOPER_TAC
QED
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
Theorem w2n_signed2unsigned:
∀w. w2n (w : 'a word) = signed2unsigned (w2i w) (dimindex (:'a))
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
Proof
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
rw [signed2unsigned_def] >> Cases_on `w` >> fs []
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
>- (
`INT_MIN (:α) ≤ n`
by (
fs [w2i_def] >> rw [] >>
BasicProvers.EVERY_CASE_TAC >> fs [word_msb_n2w_numeric] >>
rfs []) >>
rw [w2i_n2w_neg, dimword_def, int_arithTheory.INT_NUM_SUB])
>- (
`n < INT_MIN (:'a)`
by (
fs [w2i_def] >> rw [] >>
BasicProvers.EVERY_CASE_TAC >> fs [word_msb_n2w_numeric] >>
rfs []) >>
rw [w2i_n2w_pos])
QED
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
Theorem w2n_i2n:
∀w. w2n (w : 'a word) = i2n (IntV (w2i w) (dimindex (:'a)))
Proof
rw [i2n_def] >> metis_tac [w2n_signed2unsigned]
QED
[sledge sem] Prove the Load and Store cases (mostly) Summary: This required some minor tweaks to how the semantics encode values into and out of byte lists. The remaining problems have to do with how LLVM globals are translated into llair. At the moment, llair semantic's state keeps a mapping for globals to their addresses, following the LLVM semantics. However, it is not used because the translation (following the code in frontend.ml) translates LLVM globals into llair locals, which the llair semantics isn't set up to handle. Reviewed By: jberdine Differential Revision: D17930787 fbshipit-source-id: 06c6368e0
5 years ago
Theorem w2i_n2w:
∀n. n < dimword (:'a) ⇒ IntV (w2i (n2w n : 'a word)) (dimindex (:'a)) = n2i n (dimindex (:'a))
Proof
rw [n2i_def]
>- (
qspec_then `n` mp_tac w2i_n2w_neg >>
fs [dimword_def, INT_MIN_def] >> rw [GSYM INT_SUB])
>- (irule w2i_n2w_pos >> rw [INT_MIN_def])
QED
[sledge sem] Add top-level llair semantics Summary: Give the llair semantics observable side effects (writes to global variables) and a semantic function mirroring the LLVM semantics. Start sketching out the LLVM/llair translation equivalence proof in a top-down way from the obvious statement of equality of the semantics. Reviewed By: jberdine Differential Revision: D17399654 fbshipit-source-id: 2170678a8
5 years ago
Theorem eval_exp_ignores_lem:
∀s1 e v. eval_exp s1 e v ⇒ ∀s2. s1.locals = s2.locals ⇒ eval_exp s2 e v
Proof
ho_match_mp_tac eval_exp_ind >>
rw [] >> simp [Once eval_exp_cases] >>
TRY (qexists_tac `vals` >> rw [] >> fs [LIST_REL_EL_EQN] >> NO_TAC) >>
TRY (fs [LIST_REL_EL_EQN] >> NO_TAC) >>
metis_tac []
QED
Theorem eval_exp_ignores:
∀s1 e v s2. s1.locals = s2.locals ⇒ (eval_exp s1 e v ⇔ eval_exp s2 e v)
Proof
metis_tac [eval_exp_ignores_lem]
QED
[sledge sem] Sketch out translation correctness Summary: This is work in progress; many of the cheats aren't true. In particular, the definition of stuck/complete/partial traces in LLVM and llair don't quite match up and need some modification. Also, the state relation isn't strong enough; it will need to include information about registers used in the expressions of the LLVM register to llair expression mapping. But the overall shape of the proof is ok and so it can be used to poke at various local aspects of the translation, such as individual instructions. Reviewed By: jberdine Differential Revision: D17631604 fbshipit-source-id: 743b5d64d
5 years ago
Definition exp_uses_def:
(exp_uses (Var x) = {x}) ∧
(exp_uses Nondet = {}) ∧
(exp_uses (Label _) = {}) ∧
(exp_uses (Splat e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
(exp_uses (Memory e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
(exp_uses (Concat es) = bigunion (set (map exp_uses es))) ∧
(exp_uses (Integer _ _) = {}) ∧
(exp_uses (Eq e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
(exp_uses (Lt e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
(exp_uses (Ult e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
(exp_uses (Sub _ e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
(exp_uses (Record es) = bigunion (set (map exp_uses es))) ∧
(exp_uses (Select e1 e2) = exp_uses e1 ∪ exp_uses e2) ∧
[sledge sem] Implement and verify cast expressions Summary: This commit adds truncation, sign extension and zero extension to LLVM and the Convert instruction to LLAIR. The LLVM instructions use HOL's build-in word/int and word/num conversions. Sanity-checking theorems prove that zero-extending leaves the value of the word unchanged when considered as an unsigned value, and that sign-extending leaves the value unchanged when considered as a signed value. The llair semantics for Convert uses the truncate_2comp function which converts an integer to another integer as though they were represented in 2's complement. e.g. truncate_2comp 255 16 = 255, truncate_2comp 255 8 = -1, truncate_2comp -3 2 = 1 Reviewed By: jberdine Differential Revision: D18058833 fbshipit-source-id: df9de480c
5 years ago
(exp_uses (Update e1 e2 e3) = exp_uses e1 ∪ exp_uses e2 ∪ exp_uses e3) ∧
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
(exp_uses (Unsigned _ e _) = exp_uses e) ∧
(exp_uses (Signed _ e _) = exp_uses e)
[sledge sem] Sketch out translation correctness Summary: This is work in progress; many of the cheats aren't true. In particular, the definition of stuck/complete/partial traces in LLVM and llair don't quite match up and need some modification. Also, the state relation isn't strong enough; it will need to include information about registers used in the expressions of the LLVM register to llair expression mapping. But the overall shape of the proof is ok and so it can be used to poke at various local aspects of the translation, such as individual instructions. Reviewed By: jberdine Differential Revision: D17631604 fbshipit-source-id: 743b5d64d
5 years ago
Termination
WF_REL_TAC `measure exp_size` >> rw [] >>
Induct_on `es` >> rw [exp_size_def] >> res_tac >> rw []
End
Theorem eval_exp_ignores_unused_lem:
∀s1 e v.
eval_exp s1 e v ⇒
∀s2. DRESTRICT s1.locals (exp_uses e) = DRESTRICT s2.locals (exp_uses e) ⇒
eval_exp s2 e v
Proof
ho_match_mp_tac eval_exp_ind >>
rw [exp_uses_def] >> simp [Once eval_exp_cases]
>- (
fs [DRESTRICT_EQ_DRESTRICT, EXTENSION, FDOM_DRESTRICT] >>
imp_res_tac FLOOKUP_SUBMAP >>
fs [FLOOKUP_DRESTRICT]) >>
fs [drestrict_union_eq]
>- metis_tac []
>- metis_tac []
>- (
rpt (pop_assum mp_tac) >>
qid_spec_tac `vals` >>
Induct_on `es` >> rw [] >> Cases_on `vals` >> rw [PULL_EXISTS] >> fs [] >>
rw [] >> fs [drestrict_union_eq] >>
rename [`v1++flat vs`] >>
first_x_assum (qspec_then `vs` mp_tac) >> rw [] >>
qexists_tac `v1 :: vals'` >> rw [])
>- metis_tac []
>- metis_tac []
>- metis_tac []
>- metis_tac []
>- (
rpt (pop_assum mp_tac) >>
qid_spec_tac `vals` >>
Induct_on `es` >> rw [] >> fs [drestrict_union_eq])
>- metis_tac []
>- metis_tac []
[sledge sem] Implement and verify cast expressions Summary: This commit adds truncation, sign extension and zero extension to LLVM and the Convert instruction to LLAIR. The LLVM instructions use HOL's build-in word/int and word/num conversions. Sanity-checking theorems prove that zero-extending leaves the value of the word unchanged when considered as an unsigned value, and that sign-extending leaves the value unchanged when considered as a signed value. The llair semantics for Convert uses the truncate_2comp function which converts an integer to another integer as though they were represented in 2's complement. e.g. truncate_2comp 255 16 = 255, truncate_2comp 255 8 = -1, truncate_2comp -3 2 = 1 Reviewed By: jberdine Differential Revision: D18058833 fbshipit-source-id: df9de480c
5 years ago
>- metis_tac []
>- metis_tac []
[sledge sem] Sketch out translation correctness Summary: This is work in progress; many of the cheats aren't true. In particular, the definition of stuck/complete/partial traces in LLVM and llair don't quite match up and need some modification. Also, the state relation isn't strong enough; it will need to include information about registers used in the expressions of the LLVM register to llair expression mapping. But the overall shape of the proof is ok and so it can be used to poke at various local aspects of the translation, such as individual instructions. Reviewed By: jberdine Differential Revision: D17631604 fbshipit-source-id: 743b5d64d
5 years ago
QED
Theorem eval_exp_ignores_unused:
∀s1 e v s2. DRESTRICT s1.locals (exp_uses e) = DRESTRICT s2.locals (exp_uses e) ⇒ (eval_exp s1 e v ⇔ eval_exp s2 e v)
Proof
metis_tac [eval_exp_ignores_unused_lem]
QED
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
Triviality num_mod_to_int_mod:
y ≠ 0 ⇒ x MOD y = Num (&x % &y)
Proof
fs [INT_MOD]
QED
Triviality int_of_num2:
0 ≤ x ⇒ &Num x = x
Proof
metis_tac [INT_OF_NUM]
QED
Theorem int_sub_mod:
∀i j. j ≠ 0 ⇒ (i - j) % j = i % j
Proof
rw [int_mod] >>
`-j % j = 0 ∧ -j / j = -1`
by (
ONCE_REWRITE_TAC [INT_NEG_MINUS1] >> rw [] >>
rw [INT_MUL_DIV]) >>
rw [INT_ADD_DIV, int_sub, INT_RDISTRIB] >>
rw [] >>
intLib.COOPER_TAC
QED
Theorem mod_halfway:
∀i b. 0 < b ⇒ ((i + b) % (2 * b) - b < 0 ⇔ 0 ≤ i % (2 * b) - b)
Proof
rw [] >> `b ≠ 0` by intLib.COOPER_TAC >>
rw [Once (GSYM INT_MOD_PLUS)] >>
`b < 2 * b` by intLib.COOPER_TAC >>
rw [INT_LESS_MOD] >>
`0 ≤ i % (2 * b) ∧ i % (2 * b) < 2 * b`
by (
`~(2 * b < 0) ∧ 2 * b ≠ 0` by intLib.COOPER_TAC >>
drule INT_MOD_BOUNDS >>
rw []) >>
`0 ≤ i % (2 * b) + b` by intLib.COOPER_TAC >>
Cases_on `i % (2 * b) + b < 2 * b` >> rw [INT_LESS_MOD]
>- intLib.COOPER_TAC >>
simp [Once (GSYM int_sub_mod)] >>
rw [intLib.COOPER_PROVE ``∀x (b:int). x + b - (2 * b) = x - b``] >>
`i % (2 * b) − b < 2 * b` by intLib.COOPER_TAC >>
`0 ≤ i % (2 * b) − b` by intLib.COOPER_TAC >>
rw [INT_LESS_MOD] >>
intLib.COOPER_TAC
QED
Theorem unsigned_truncate:
∀m n i.
0 < m ∧ m ≤ n ∧ -i ≤ 2 ** n
⇒
signed2unsigned (truncate_2comp i m) m = signed2unsigned i n MOD (2 ** m)
Proof
rw [signed2unsigned_def, truncate_2comp_def] >>
qabbrev_tac `b = &(2 ** (m - 1))` >>
`&((2:num) ** m) = 2 * b`
by (rw [Abbr `b`] >> Cases_on `m` >> fs [ADD1, EXP_ADD]) >>
`0 < b` by rw [Abbr `b`] >>
`0 < 2 * b ∧ 0 ≠ 2 * b ∧ b < 2 * b` by (rw [Abbr `b`] >> intLib.COOPER_TAC) >>
asm_simp_tac std_ss [num_mod_to_int_mod] >>
fs [mod_halfway] >>
`∃x. &(2 ** n) = 2 * b * 2 ** x`
by (
rw [Abbr `b`, GSYM EXP_ADD] >>
`2 = 2 ** 1` by rw [] >>
`∀x. 2 * 2 ** (m + x - 1) = 2 ** (1 + (m + x - 1))` by metis_tac [EXP_ADD] >>
rw [] >>
qexists_tac `n - m` >> rw []) >>
irule (METIS_PROVE [] ``x = y ⇒ f x = f y``) >>
fs [GSYM int_le] >>
rw [int_of_num2] >>
rw [intLib.COOPER_PROVE ``∀(x:int) b. 2 * b + (x - b) = b + x``] >>
`0 ≤ i % (2 * b) ∧ i % (2 * b) < 2 * b`
by (
`~(2 * b < 0) ∧ 2 * b ≠ 0` by intLib.COOPER_TAC >>
drule INT_MOD_BOUNDS >>
rw [])
>- (
`0 ≤ 2 * b * &(2 ** x) + i` by intLib.COOPER_TAC >>
rw [int_of_num2] >>
`2 * b ≠ 0` by intLib.COOPER_TAC >>
drule INT_MOD_ADD_MULTIPLES >>
rw [Once INT_MUL_COMM] >>
rw [Once (GSYM INT_MOD_PLUS)] >>
rw [INT_LESS_MOD] >>
simp [Once (GSYM int_sub_mod)] >>
rw [intLib.COOPER_PROVE ``∀x (b:int). x + b - (2 * b) = x - b``] >>
`i % (2 * b) − b < 2 * b` by intLib.COOPER_TAC >>
rw [INT_LESS_MOD])
>- (
rw [Once (GSYM INT_MOD_PLUS)] >>
rw [INT_LESS_MOD] >>
simp [Once (GSYM int_sub_mod)] >>
rw [intLib.COOPER_PROVE ``∀x (b:int). x + b - (2 * b) = x - b``] >>
`i % (2 * b) − b < 2 * b` by intLib.COOPER_TAC >>
rw [INT_LESS_MOD])
>- (
`0 ≤ 2 * b * &(2 ** x) + i` by intLib.COOPER_TAC >>
rw [int_of_num2] >>
`2 * b ≠ 0` by intLib.COOPER_TAC >>
drule INT_MOD_ADD_MULTIPLES >>
rw [Once INT_MUL_COMM] >>
rw [Once (GSYM INT_MOD_PLUS)] >>
rw [INT_LESS_MOD] >>
`i % (2 * b) + b < 2 * b` by intLib.COOPER_TAC >>
rw [INT_LESS_MOD] >>
intLib.COOPER_TAC)
>- (
rw [Once (GSYM INT_MOD_PLUS)] >>
rw [INT_LESS_MOD] >>
`i % (2 * b) + b < 2 * b` by intLib.COOPER_TAC >>
rw [INT_LESS_MOD] >>
intLib.COOPER_TAC)
QED
[sledge sem] Add proof of bit cast implementation Summary: Add some theorems establishing the correspondence between the implementation of the Convert operation in OCaml and the definition of Convert in the semantics. Essentially, the OCaml version is in terms of extracting certain ranges of bits, whereas the semantics is in terms of integer arithmetic (addition, modulus, and exponentiation) Reviewed By: jberdine Differential Revision: D18113878 fbshipit-source-id: c318596d0
5 years ago
(* Relate the semantics of Convert to something more closely following the
* implementation *)
Definition Zextract_def:
Zextract (:'a) z off len = &w2n ((len+off-1 -- off) (i2w z : 'a word))
End
Definition Zsigned_extract_def:
Zsigned_extract (:'a) z off len = w2i ((len+off-1 --- off) (i2w z : 'a word))
End
(*
* Some tests of extract and signed_extract in both HOL and OCaml to check that
* we are defining the same thing *)
(*
EVAL ``
let bp1 = 0b11001100w : word8 in
let bp2 = 0b01011011w : word8 in
let i1 = &(w2n bp1) in
let i2 = w2i bp1 in
let i3 = &(w2n bp2) in
Zextract (:128) i1 0 8 = i1 ∧
Zextract (:128) i2 0 8 = i1 ∧
Zextract (:128) i3 0 8 = i3 ∧
Zsigned_extract (:128) i1 0 8 = i2 ∧
Zsigned_extract (:128) i2 0 8 = i2 ∧
Zsigned_extract (:128) i3 0 8 = i3 ∧
Zextract (:128) i1 2 4 = 3 ∧
Zextract (:128) i2 2 4 = 3 ∧
Zextract (:128) i1 2 5 = 19 ∧
Zextract (:128) i2 2 5 = 19 ∧
Zextract (:128) i3 1 2 = 1 ∧
Zextract (:128) i3 1 3 = 5 ∧
Zsigned_extract (:128) i1 2 4 = 3 ∧
Zsigned_extract (:128) i2 2 4 = 3 ∧
Zsigned_extract (:128) i1 2 5 = -13 ∧
Zsigned_extract (:128) i2 2 5 = -13 ∧
Zsigned_extract (:128) i3 1 2 = 1 ∧
Zsigned_extract (:128) i3 1 3 = -3``
let i1 = Z.of_int 0b11001100 in
let i2 = Z.of_int (-52) in
let i3 = Z.of_int 0b01011011 in
Z.extract i1 0 8 = i1 &&
Z.extract i2 0 8 = i1 &&
Z.extract i3 0 8 = i3 &&
Z.signed_extract i1 0 8 = i2 &&
Z.signed_extract i2 0 8 = i2 &&
Z.signed_extract i3 0 8 = i3 &&
Z.extract i1 2 4 = Z.of_int 3 &&
Z.extract i2 2 4 = Z.of_int 3 &&
Z.extract i1 2 5 = Z.of_int 19 &&
Z.extract i2 2 5 = Z.of_int 19 &&
Z.extract i3 1 2 = Z.of_int 1 &&
Z.extract i3 1 3 = Z.of_int 5 &&
Z.signed_extract i1 2 4 = Z.of_int 3 &&
Z.signed_extract i2 2 4 = Z.of_int 3 &&
Z.signed_extract i1 2 5 = Z.of_int (-13) &&
Z.signed_extract i2 2 5 = Z.of_int (-13) &&
Z.signed_extract i3 1 2 = Z.of_int 1 &&
Z.signed_extract i3 1 3 = Z.of_int (-3);;
*)
Theorem Zextract0:
dimindex (:'b) ≤ dimindex (:'a)
⇒
Zextract (:'a) i 0 (dimindex (:'b)) = &w2n (i2w i : 'b word)
Proof
rw [Zextract_def] >>
`w2n ((dimindex (:β) − 1 -- 0) (i2w i : 'a word)) =
w2n (w2w (i2w i : 'a word) : 'b word)`
by (
rw [w2n_w2w] >>
`dimindex (:'b) = dimindex (:'a)` by decide_tac >>
fs [WORD_ALL_BITS]) >>
rw [w2w_i2w]
QED
Theorem Zsigned_extract0:
dimindex (:'b) ≤ dimindex (:'a)
⇒
Zsigned_extract (:'a) i 0 (dimindex (:'b)) = w2i (i2w i : 'b word)
Proof
rw [Zsigned_extract_def] >>
rw [word_sign_extend_bits, word_sign_extend_def, ADD1] >>
`0 < dimindex (:'b) ⇒ dimindex (:'b) - 1 + 1 = dimindex (:'b)` by decide_tac >>
`min (dimindex (:β)) (dimindex (:α)) = dimindex (:β)` by fs [MIN_DEF] >>
rw [] >>
`w2n ((dimindex (:β) − 1 -- 0) (i2w i : 'a word)) =
w2n (w2w (i2w i : 'a word) : 'b word)`
by (
rw [w2n_w2w] >>
`dimindex (:'b) = dimindex (:'a)` by decide_tac >>
fs [WORD_ALL_BITS]) >>
rw [GSYM sw2sw_def, w2w_i2w] >>
rw [w21_sw2sw_extend]
QED
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
Theorem signed_extract_truncate_2comp:
dimindex (:'b) ≤ dimindex (:'a)
⇒
Zsigned_extract (:'a) i 0 (dimindex (:'b)) = truncate_2comp i (dimindex (:'b))
Proof
rw [] >>
drule Zsigned_extract0 >> rw [] >>
metis_tac [truncate_2comp_i2w_w2i]
QED
Theorem unsigned_extract_truncate_2comp:
dimindex (:'b) ≤ dimindex (:'a)
⇒
Zextract (:'a) i 0 (dimindex (:'b)) = &signed2unsigned (truncate_2comp i (dimindex (:'b))) (dimindex (:'b))
Proof
rw [] >> drule Zextract0 >> rw [w2n_i2w] >>
`∃n. -i ≤ 2 ** n ∧ dimindex (:'b) ≤ n`
by (
Cases_on `i < 0` >> rw []
>- (
`∃j. i = -&j` by intLib.COOPER_TAC >>
rw [] >>
`1 < 2` by decide_tac >>
drule EXP_ALWAYS_BIG_ENOUGH >>
disch_then (qspec_then `j` mp_tac) >>
rw [] >>
qexists_tac `MAX m (dimindex (:'b))` >>
rw [MAX_DEF] >>
drule bitTheory.TWOEXP_MONO >>
intLib.COOPER_TAC)
>- (
`∃j. i = &j` by intLib.COOPER_TAC >>
rw [] >>
metis_tac [])) >>
`0 < dimword (:'b) ∧ 0 < dimindex (:'b)` by rw [DIMINDEX_GT_0, ZERO_LT_dimword] >>
`0 ≠ dimindex (:'b) ∧ 0 ≠ dimword (:'b)` by decide_tac >>
drule unsigned_truncate >>
ntac 2 (disch_then drule) >>
rw [GSYM dimword_def] >>
rw [signed2unsigned_def]
>- (
asm_simp_tac std_ss [GSYM INT_MOD] >>
`0 ≤ &(2 ** n) + i`
by (fs [INT_EXP] >> intLib.COOPER_TAC) >>
asm_simp_tac std_ss [int_of_num2] >>
`∃j. i = -&j` by intLib.COOPER_TAC >>
rw [] >>
`∃x. &(2 ** n) = dimword (:'b) * 2 ** x`
by (
rw [GSYM EXP_ADD, dimword_def] >>
qexists_tac `n - dimindex (:'b)` >> rw []) >>
rw [] >>
`&dimword (:β) ≠ 0` by intLib.COOPER_TAC >>
drule INT_MOD_ADD_MULTIPLES >>
simp_tac std_ss [Once INT_MUL_COMM, GSYM INT_MUL])
>- (
`∃j. i = &j` by intLib.COOPER_TAC >>
rw [])
QED
Definition simp_signed_def:
simp_signed (:'a) bits arg to_t =
case arg of
| Integer data _ => Integer (Zsigned_extract (:'a) data 0 bits) to_t
| _ => Signed bits arg to_t
End
Definition simp_unsigned_def:
simp_unsigned (:'a) bits arg to_t =
case arg of
| Integer data _ => Integer (Zextract (:'a) data 0 bits) to_t
| _ => Signed bits arg to_t
End
Theorem signed_implementation_fits:
∀const i to_t from_t.
dimindex (:'b) ≤ sizeof_bits to_t ∧
[sledge sem] Update sanity proof for LLAIR convert Summary: The old version of simp_convert in LLAIR had a bug, but the sanity theorem didn't catch it because it didn't enforce that the result fit into the size it should have. This updates to newer version of simp_convert and adds a theorem that the result fits. Reviewed By: jberdine Differential Revision: D18346833 fbshipit-source-id: 533c836bf
5 years ago
dimindex (:'b) ≤ dimindex (:'a)
⇒
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
∃i2.
simp_signed (:'a) (dimindex (:'b)) (Integer i from_t) to_t =
Integer i2 to_t ∧ ifits i2 (sizeof_bits to_t)
[sledge sem] Update sanity proof for LLAIR convert Summary: The old version of simp_convert in LLAIR had a bug, but the sanity theorem didn't catch it because it didn't enforce that the result fit into the size it should have. This updates to newer version of simp_convert and adds a theorem that the result fits. Reviewed By: jberdine Differential Revision: D18346833 fbshipit-source-id: 533c836bf
5 years ago
Proof
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
rw [simp_signed_def] >>
drule Zsigned_extract0 >> rw [] >>
`ifits (w2i (i2w i : 'b word)) (dimindex (:'b))` by metis_tac [ifits_w2i] >>
metis_tac [ifits_mono]
QED
Theorem unsigned_implementation_fits:
∀const i to_t from_t.
dimindex (:'b) < sizeof_bits to_t ∧
dimindex (:'b) ≤ dimindex (:'a)
⇒
∃i2.
simp_unsigned (:'a) (dimindex (:'b)) (Integer i from_t) to_t =
Integer i2 to_t ∧ ifits i2 (sizeof_bits to_t)
Proof
rw [simp_unsigned_def] >>
drule Zextract0 >> rw [] >> rw [w2n_i2w] >>
fs [ifits_def, dimword_def] >> rw [] >>
qspecl_then [`i`, `&(2 ** dimindex (:β))`] mp_tac INT_MOD_BOUNDS >>
rw []
[sledge sem] Update sanity proof for LLAIR convert Summary: The old version of simp_convert in LLAIR had a bug, but the sanity theorem didn't catch it because it didn't enforce that the result fit into the size it should have. This updates to newer version of simp_convert and adds a theorem that the result fits. Reviewed By: jberdine Differential Revision: D18346833 fbshipit-source-id: 533c836bf
5 years ago
>- (
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
`0 <= (2:num) ** (sizeof_bits to_t − 1)` by intLib.COOPER_TAC >>
intLib.COOPER_TAC)
[sledge sem] Update sanity proof for LLAIR convert Summary: The old version of simp_convert in LLAIR had a bug, but the sanity theorem didn't catch it because it didn't enforce that the result fit into the size it should have. This updates to newer version of simp_convert and adds a theorem that the result fits. Reviewed By: jberdine Differential Revision: D18346833 fbshipit-source-id: 533c836bf
5 years ago
>- (
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
`2 ** dimindex (:'b) ≤ 2 ** (sizeof_bits to_t - 1)` suffices_by intLib.COOPER_TAC >>
[sledge sem] Update sanity proof for LLAIR convert Summary: The old version of simp_convert in LLAIR had a bug, but the sanity theorem didn't catch it because it didn't enforce that the result fit into the size it should have. This updates to newer version of simp_convert and adds a theorem that the result fits. Reviewed By: jberdine Differential Revision: D18346833 fbshipit-source-id: 533c836bf
5 years ago
rw [])
QED
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
Theorem signed_implementation:
∀to_t i from_t h m n.
dimindex (:'b) ≤ sizeof_bits to_t ∧
dimindex (:'b) ≤ dimindex (:'a) ∧
from_t = IntegerT m ∧
to_t = IntegerT n ∧
0 < m ∧
ifits i m
[sledge sem] Add proof of bit cast implementation Summary: Add some theorems establishing the correspondence between the implementation of the Convert operation in OCaml and the definition of Convert in the semantics. Essentially, the OCaml version is in terms of extracting certain ranges of bits, whereas the semantics is in terms of integer arithmetic (addition, modulus, and exponentiation) Reviewed By: jberdine Differential Revision: D18113878 fbshipit-source-id: c318596d0
5 years ago
⇒
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
eval_exp h (Signed (dimindex (:'b)) (Integer i from_t) to_t) =
eval_exp h (simp_signed (:'a) (dimindex (:'b)) (Integer i from_t) to_t)
[sledge sem] Add proof of bit cast implementation Summary: Add some theorems establishing the correspondence between the implementation of the Convert operation in OCaml and the definition of Convert in the semantics. Essentially, the OCaml version is in terms of extracting certain ranges of bits, whereas the semantics is in terms of integer arithmetic (addition, modulus, and exponentiation) Reviewed By: jberdine Differential Revision: D18113878 fbshipit-source-id: c318596d0
5 years ago
Proof
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
rw [EXTENSION, IN_DEF] >> simp [simp_signed_def] >>
[sledge sem] Add proof of bit cast implementation Summary: Add some theorems establishing the correspondence between the implementation of the Convert operation in OCaml and the definition of Convert in the semantics. Essentially, the OCaml version is in terms of extracting certain ranges of bits, whereas the semantics is in terms of integer arithmetic (addition, modulus, and exponentiation) Reviewed By: jberdine Differential Revision: D18113878 fbshipit-source-id: c318596d0
5 years ago
ONCE_REWRITE_TAC [eval_exp_cases] >>
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
fs [] >>
[sledge sem] Add proof of bit cast implementation Summary: Add some theorems establishing the correspondence between the implementation of the Convert operation in OCaml and the definition of Convert in the semantics. Essentially, the OCaml version is in terms of extracting certain ranges of bits, whereas the semantics is in terms of integer arithmetic (addition, modulus, and exponentiation) Reviewed By: jberdine Differential Revision: D18113878 fbshipit-source-id: c318596d0
5 years ago
ONCE_REWRITE_TAC [eval_exp_cases] >> rw [] >>
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
`0 < m` by decide_tac >>
`truncate_2comp i m = i` by metis_tac [fits_ident] >>
rw [] >> fs [sizeof_bits_def] >>
irule (METIS_PROVE [] ``y = z ⇒ (x = y ⇔ x = z)``) >> rw [] >>
rw [signed_extract_truncate_2comp] >>
`0 < dimindex (:'b)` by metis_tac [DIMINDEX_GT_0] >>
[sledge sem] Update sanity proof for LLAIR convert Summary: The old version of simp_convert in LLAIR had a bug, but the sanity theorem didn't catch it because it didn't enforce that the result fit into the size it should have. This updates to newer version of simp_convert and adds a theorem that the result fits. Reviewed By: jberdine Differential Revision: D18346833 fbshipit-source-id: 533c836bf
5 years ago
`0 < n` by decide_tac >>
[sledge sem] Update integer conversions to new LLAIR Summary: LLAIR changed how it represents integer-to-integer conversions, and this updates the semantics and proofs to show that the new way is correct. Reviewed By: jberdine Differential Revision: D18448616 fbshipit-source-id: b657fcd20
5 years ago
`ifits (truncate_2comp i (dimindex (:β))) n` suffices_by metis_tac [fits_ident] >>
metis_tac [truncate_2comp_fits, ifits_mono]
QED
Theorem unsigned_implementation:
∀to_t i from_t h m n.
dimindex (:'b) < sizeof_bits to_t ∧
dimindex (:'b) ≤ dimindex (:'a) ∧
from_t = IntegerT m ∧
to_t = IntegerT n ∧
0 < m ∧
ifits i m
⇒
eval_exp h (Unsigned (dimindex (:'b)) (Integer i from_t) to_t) =
eval_exp h (simp_unsigned (:'a) (dimindex (:'b)) (Integer i from_t) to_t)
Proof
rw [EXTENSION, IN_DEF] >> simp [simp_unsigned_def] >>
ONCE_REWRITE_TAC [eval_exp_cases] >>
fs [] >>
ONCE_REWRITE_TAC [eval_exp_cases] >> rw [] >>
`0 < m` by decide_tac >>
`truncate_2comp i m = i` by metis_tac [fits_ident] >>
rw [] >> fs [sizeof_bits_def] >>
irule (METIS_PROVE [] ``y = z ⇒ (x = y ⇔ x = z)``) >> rw [] >>
rw [unsigned_extract_truncate_2comp] >>
`0 < dimindex (:'b)` by metis_tac [DIMINDEX_GT_0] >>
`0 < n` by decide_tac >>
`ifits (&signed2unsigned (truncate_2comp i (dimindex (:β))) (dimindex (:'b))) n` suffices_by metis_tac [fits_ident] >>
irule ifits_mono >>
qexists_tac `dimindex (:'b) + 1` >> rw [] >>
metis_tac [truncate_2comp_fits, signed2unsigned_fits]
[sledge sem] Add proof of bit cast implementation Summary: Add some theorems establishing the correspondence between the implementation of the Convert operation in OCaml and the definition of Convert in the semantics. Essentially, the OCaml version is in terms of extracting certain ranges of bits, whereas the semantics is in terms of integer arithmetic (addition, modulus, and exponentiation) Reviewed By: jberdine Differential Revision: D18113878 fbshipit-source-id: c318596d0
5 years ago
QED
[sledge sem] Start sketching translation correctness Summary: This includes a few changes and corrections to the semantics, to support the translation. This initial attempt to reason about LLVM -> llair showed three things that needed repair in the semantics, in addition to various bugs. We address them as follows. Refactor llair semantics to have only a single kind of flat value: integers that fit into specified bit widths. Operations on size values (e.g., offsets, indices and the like) can just take an integer and ignore its number of bits. Pointers can just be considered integers that fit into a certain size given by the constant pointer_size. Later on we can consider making this a parameter to the model. Change the generic memory model interface to use numbers rather than words as the generic encoding of a large value. This makes it more useful for llair where words are not used. Pay more careful attention to signed/unsigned issues. Neither LLVM nor llair have a concept of signed vs unsigned value. Instead individual operations interpret bit patterns in various ways, some of which are ambiguous in the LLVM manual. For example, since getelementpointer's indices are explicitly said to be interpreted as signed 2's complement, we should probably do the same for insertvalue and extractvalue. However it is not clear how the argument to alloca is to be interpreted. For now we assume signed. Reviewed By: jberdine Differential Revision: D17164133 fbshipit-source-id: 31a8af635
5 years ago
export_theory ();